ucef/as-talange
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): write secret key to runner file before docker run to preserve multi-line format

Browse Source
This commit is contained in:
ucef
2026-09-03 15:26:22 +02:00
parent 7450ea07ab
commit 1231947e2b
1 changed files with 23 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci-prod.yml
+23 -16
View File
@@ -128,39 +128,46 @@ jobs:
TARGET_USER="${DB_SERVER_USER:-root}"
PORT="${REMOTE_PORT:-22}"
DEST_DIR="/opt/as-talange"
KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
rm -f /tmp/gitea_runner_key
if [ -n "${RAW_KEY}" ]; then
printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key
elif [ -f /root/.ssh/gitea_ci_key ]; then
cp /root/.ssh/gitea_ci_key /tmp/gitea_runner_key
elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then
cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key
fi
if [ ! -s /tmp/gitea_runner_key ]; then
echo "ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!"
exit 1
fi
chmod 600 /tmp/gitea_runner_key
docker run --rm --net=host \
-v "$(pwd):/workspace" -w /workspace \
-v "/tmp/gitea_runner_key:/tmp/id_rsa:ro" \
-e TARGET_HOST="${TARGET_HOST}" \
-e TARGET_USER="${TARGET_USER}" \
-e PORT="${PORT}" \
-e DEST_DIR="${DEST_DIR}" \
-e KEY_CONTENT="${KEY_CONTENT}" \
alpine:latest sh -c '
apk add --no-cache openssh-client rsync && \
echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
echo "Destination Directory: ${DEST_DIR}" && \
if [ -n "$KEY_CONTENT" ]; then \
echo "--> USING SSH KEY FROM GITEA SECRET" && \
printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \
elif [ -f /root/.ssh/gitea_ci_key ]; then \
echo "--> USING SSH KEY FROM FILE: /root/.ssh/gitea_ci_key" && \
cp /root/.ssh/gitea_ci_key /tmp/id_rsa ; \
else \
echo "--> ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" && exit 1 ; \
fi && \
chmod 600 /tmp/id_rsa && \
cp /tmp/id_rsa /tmp/working_key && \
chmod 600 /tmp/working_key && \
echo "=== 🔑 KEY FINGERPRINT ===" && \
ssh-keygen -l -f /tmp/id_rsa && \
SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
ssh-keygen -l -f /tmp/working_key && \
SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \
rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
echo "=== 📦 RSYNC TRANSFER ENV ===" && \
rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
'